11 ms·

I think we are approaching a transitionary period where lines by various companies are starting to be drawn in the sand with regards to privacy and user hostile

I think we are approaching a transitionary period where lines by various companies are starting to be drawn in the sand with regards to privacy and user hostile design choices. It's still a little blury, but as the lines become clearer users will start to shift. And either by choice or regulation the lines will be drawn. Apple's hand is being forced in some cases, but usually in a direction they are already heading. Google will find the balance much harder due to the nature of their revenue model.

Despegar 8y ago
Yes things are starting to swing towards privacy. We have GDPR, Facebook's constant fuck ups, and Apple publicly dunking on the ad-tech industry to thank for that.
- rocqua 8y ago
  Recently someone on HN mentioned off-hand that changes to the chrome extension model are coming. Specifically, these changes would break ad-blockers as they currently work. Point being, there is some movement against this.
ppeetteerr 8y ago
Apple is following up on their own promise to be a privacy-first company. That's their game now and they are playing it respectably. First, they removed Facebook from Internet Accounts in settings, then they blocked Facebook's enterprise certificate and now this. Remember that Apple was one of the first to send an anonymous MAC address to Wifi hotspots so that advertisers could not track a user in real space.
- wtmt 8y ago
  > First, they removed Facebook from Internet Accounts in settings, then they blocked Facebook's enterprise certificate and now this. Just to make it clearer, the removal of Facebook in the accounts was not about Facebook alone (though it may have been the cause for the decision). Integrations with Twitter, Vimeo, etc., were also removed together. Facebook’s enterprise certificate was revoked because it violated Apple’s policy by using it to distribute applications to users who’re not “internal” and not employees/contractors. That the app in question was also sleazy (as Facebook usually seems to be) was a coincidence in this case. But it’s also true that that app wouldn’t have passed the App Store review process had it been submitted there.
  - JumpCrisscross 8y ago
    > Facebook’s enterprise certificate was revoked because it violated Apple’s policy by using it to distribute applications to users who’re not “internal” and not employees/contractors. That the app in question was also sleazy (as Facebook usually seems to be) was a coincidence in this case. The rules were written to block sleazy apps. That the rules were the instrument by which the certificates were revoked doesn’t decouple the app’s sleaziness from its removal. (Similarly, saying “he went to jail for stealing” is accurate. Despite the reason for the jailing being the statute banning stealing.)
    - saagarjha 8y ago
      > The rules were written to block sleazy apps. No, they weren't; they were written to block distribution of applications without formal App Store review to the general public.
      - kinkrtyavimoodh 8y ago
        Thank you. It's frustrating to see people completely throw facts out of the window as soon as it comes to hating on their favorite bugbears. Today Facebook and Google, tomorrow something else.
        lloeki 8y ago
        I can see the general strategy there though: it's easier to be excessively stringent then improve and relax through iteration and emergent discovery of use cases than the other way around. E.g accessing the filesystem used to be downright impossible in the MAS, preventing apps like Coda or DaisyDisk from even existing due to stringent sandboxing, but now it's perfectly possible.
  - GeekyBear 8y ago
    >Just to make it clearer, the removal of Facebook in the accounts was not about Facebook alone (though it may have been the cause for the decision). Integrations with Twitter, Vimeo, etc., were also removed together. That one has more to do with Apple releasing frameworks that allowed any of the internet services to tie into iOS themselves. For instance, share extensions: >Share extensions give users a convenient way to share content with other entities, such as social sharing websites or upload services. https://developer.apple.com/library/archive/documentation/General/Conceptual/ExtensibilityPG/Share.html https://developer.apple.com/library/archive/documentation/Ge... Apple no longer needed to pick winners and add integration for them into the OS by hand. >Facebook’s enterprise certificate was revoked because it violated Apple’s policy by using it to distribute applications to users who’re not “internal” and not employees/contractors. That the app in question was also sleazy (as Facebook usually seems to be) was a coincidence in this case. But it’s also true that that app wouldn’t have passed the App Store review process had it been submitted there. Facebook's spyware in a VPN's clothing had already been kicked off of the App Store last year. >Onavo, which Facebook bought back in 2013, does two things. As far as regular consumers are concerned, Onavo comports itself like a VPN, offering to “keep you and your data safe” and “blocking potentially harmful websites and securing your personal information.” But Onavo’s real utility is pumping a ton of app usage data to its parent company https://techcrunch.com/2018/08/22/apple-facebook-onavo/ https://techcrunch.com/2018/08/22/apple-facebook-onavo/
- minikites 8y ago
  >Apple is following up on their own promise to be a privacy-first company. Only after the media takes notice and it makes Apple look bad. In both this case and the "FacePalm" FaceTime spying incident, Apple knew for months. You shouldn't get brownie points for getting coerced into good behavior.
  - dpcx 8y ago
    Is there a source for Apple knowing about the FaceTime incident for months?
paulryanrogers 8y ago
Actually I'd say Apple is swinging only toward user choice where it suits them. The recent change to the default media player for play-pause away from the last app and to Apple Music is one example. Dropping Do-not-track from Safari is another.
- ppeetteerr 8y ago
  Not sure how DNT fits into this. No advertiser respected this flag and, ironically, some used it to finger print a user's device.
  - crankylinuxuser 8y ago
    Yeah, DNT was dead on arrival. I have no clue why the internet powers that be though that would be effective in any way. I guess its more of a feel good action.
    - paulryanrogers 8y ago
      It needs legislation behind it
      - exodust 8y ago
        Like "we use cookies, agree/disagree" irritating waste of space legislation that means nothing beyond the borders of wherever it was legislated?
        Reason077 8y ago
        The EU got it wrong with the popup aspect of cookies/GDPR legislation. It's just bad UX. A DNT-style browser feature with legal weight behind it would have been miles better. Your browser could present a consistent interface for every website that requests consent, and allow you to set global defaults, etc.
        8y ago
skybrian 8y ago
Google's original business model was selling ads against search terms for users who aren't even logged in. They sell ads in a lot of other ways now, and do what they can to keep people logged in. But if they had to go back to it, they would still make lots of money, because a search query is still a really good signal of the user's intent to buy something.
- willio58 8y ago
  Wouldn’t duck duck go be making a lot of money by now if this was the case?
  - Reason077 8y ago
    What makes you think they're not? Reportedly, duck duck go are now serving over 1 billion searches per month. If they're earning, say, $0.01 per search from ads, well... you do the math. Not bad for a small startup company with 55 employees.
    - asdfasgasdgasdg 8y ago
      That would be pretty high. Google's are in the neighborhood of $3/1000 for impressions and $0.75 per click. Recall that many SERPs don't even show ads.
  - skybrian 8y ago
    If they had anywhere close to the amount of traffic Google gets, they would.
  - asark 8y ago
    Look at it this way: Say tracking is perceived to add some value over content-based ad selection (doesn't matter if it actually does). Say it also provides a bunch of important looking metrics for middle managers and execs to play with, whether or not any of it means anything (that it certainly does). Say the price premium charged by Google and FaceBook and friends is under what companies value this stuff at, in dollar terms. There's a small premium to it, say 10%, some of which goes to the sites displaying the ads. Boom, practically all advertising is now of the spyware variety. That's all it takes. Competing without spying (and without a huge trove of data or a way to get it fast) is now nigh-impossible. Now outlaw all the tracking crap. "Oh no the Web is doomed no one will be able to pay for anything!" you will hear/read from a disturbingly large number of people. They are dumb. It'll be fine. That 10% premium goes away, yeah. Content advertising is back. Having a huge trove of user data is no longer a moat, or indeed much advantage at all, in the ad space, so Google'd need to scale back and/or learn how to launch a product that can stand on its own without the backing of their spyware empire. IOW yeah they'll probably actually be in serious trouble, but there's no good reason for them to be. FaceBook might die or have to pivot hard. But that does not mean the end of the web, or anything like it! It just means the ad money goes somewhere else. Probably to a bunch of much smaller (though still maybe quite large) companies. Anyway TL;DR it's difficult to succeed with non-spying ads in a spying-is-allowed world, but it's 100% for sure a viable business model that can support more or less the same junk we have now if you outlaw that sort of bad behavior. To the extent DDG's succeeding I assume it's their dark patterns and maybe (I am just guessing on this second one) they also do that extorting-companies-into-buying-ads-for-themselves thing like Google does.
kbenson 8y ago
I wonder, is there a list, possibly broken down by segment, that shows the relatively privacy friendly companies in that segment? Personally I would also like to see a check or not in a few categories for each for things like "Public statements supporting privacy", "Software/service features support privacy", "Business model supports/supported by privacy" and "has resisted/advocated against privacy encroaching laws or overly broad legal orders". That's a tall order, but it seems like the thing that could be mostly crowd-sourced to good effect (with a few moderators to ensure accuracy).
- tedd4u 8y ago
  Not exactly what you're looking for but EFF has some data: https://www.eff.org/who-has-your-back-2018 https://www.eff.org/who-has-your-back-2018 https://www.eff.org/who-has-your-back-2017 https://www.eff.org/who-has-your-back-2017
  - kbenson 8y ago
    That's pretty nice, thanks! Although it does seem a little odd that Youtube has full marks when there's quite a lot of info about their broken take down system and appeals process...
  - dzink 8y ago
    Not sure I’d trust this list. All my email addresses submitted to Adobe and previously Macromedia have come back with scammy spam of epic proportions compared to any other company I’ve submitted emails to. This list has them at 5 stars. Could be they sold or they got hacked, and maybe it no longer happens, but even new emails as of 2 years ago suffered the same fate over time.
    - kbenson 8y ago
      Not that I can vouch for the list, but it's not if Adobe got hacked, they are well known for being victims of some very large hack(s?).[1] Other than that, I hope you're not using cracked versions of any Adobe software or commercial filters, or key generators for either on systems that have any personal information... 1: https://www.theverge.com/2013/11/7/5078560/over-150-million-breached-records-from-adobe-hack-surface-online https://www.theverge.com/2013/11/7/5078560/over-150-million-...
Razengan 8y ago
As a user, I am always glad for Apple protecting me from asshole developers. There is still a lot to be done, but it would be much worse. Some bigger culprits, due to being bigger, still get away with their bullshit. For example, Google apps uses/used an embedded web view for sign-in, which also signs you into their web search in Safari. They share the sign-in in a way that even newly-installed apps can use; e.g. sign into YouTube, install Google Maps, and you will find yourself already signed into Google Maps when you open the app (in my case, for the first time on this device just now.) This may be convenient, but feels creepy and intrusive as hell. Facebook, Instagram etc. also continue to be major offenders for things like iPad UX guidelines.
- deleted 8y ago
  [deleted]
- banachtarski 8y ago
  Not a google employee but the example you cite is hardly the design of "asshole developers." Single-sign on is convenient, and I'm glad I can monitor any illicit usage/sign-on for any of the sites you mentioned in a single place. Apple protects you from asshole developers, but it also restricts you from just installing what you want in the first place and they take a 30% cut of all revenue while doing so. I hardly think they do it out of the charity of their hearts.
  - pyrale 8y ago
    We track you for your own good/Apple are not an NGO anyway.
  - Razengan 8y ago
    I have no need to tell YouTube my location, but if I signed into YouTube, then install Google Maps and agree to its location sharing prompt, bam, now Google can link my viewing history (and more) with my precise location, because Google Maps automatically signed into my account as soon as I launched the app. How is this not intrusive?
    - 8y ago
on_and_off 8y ago
>but as the lines become clearer users will start to shift. I wish to be wrong but e.g. facebook has demonstrated that users don't really care. Not sure that anything can change that, although I would love to see it happen.
- Firadeoclus 8y ago
  > I wish to be wrong but e.g. facebook has demonstrated that users don't really care. Facebook's user demographic _is_ shifting, though, and the conversation around the company and product in the media has changed significantly. That might not immediately show large effects, but network effects driving sign-up also work in reverse and could trigger an avalanche of users leaving in the future.
dalbasal 8y ago
Facebook will find it hardest of all, but at least they don't do OSS. Google ads still work (command a good price) without the creepy stuff. "in Lisbon, searching for dentists." is enough for good as targeting. Facebook ads are near worthless without the creepy targeting and such. Apple is in quite a unique position to distinguish themselves, if they choose.
- have_faith 8y ago
  I actually wrote something about Facebook last night: https://medium.com/@adamjaggard/facebook-will-die-of-boredom-before-any-privacy-issues-bring-it-down-14ccf358c1ce https://medium.com/@adamjaggard/facebook-will-die-of-boredom... I think Facebook will kill itself separate to everything else going on in the industry with regards to privacy. I think Facebook's value proposition is wearing thin.

Despegar 8y ago

Yes things are starting to swing towards privacy. We have GDPR, Facebook's constant fuck ups, and Apple publicly dunking on the ad-tech industry to thank for that.

rocqua 8y ago
Recently someone on HN mentioned off-hand that changes to the chrome extension model are coming. Specifically, these changes would break ad-blockers as they currently work. Point being, there is some movement against this.

ppeetteerr 8y ago

Apple is following up on their own promise to be a privacy-first company. That's their game now and they are playing it respectably. First, they removed Facebook from Internet Accounts in settings, then they blocked Facebook's enterprise certificate and now this. Remember that Apple was one of the first to send an anonymous MAC address to Wifi hotspots so that advertisers could not track a user in real space.

wtmt 8y ago
> First, they removed Facebook from Internet Accounts in settings, then they blocked Facebook's enterprise certificate and now this. Just to make it clearer, the removal of Facebook in the accounts was not about Facebook alone (though it may have been the cause for the decision). Integrations with Twitter, Vimeo, etc., were also removed together. Facebook’s enterprise certificate was revoked because it violated Apple’s policy by using it to distribute applications to users who’re not “internal” and not employees/contractors. That the app in question was also sleazy (as Facebook usually seems to be) was a coincidence in this case. But it’s also true that that app wouldn’t have passed the App Store review process had it been submitted there.
- JumpCrisscross 8y ago
  > Facebook’s enterprise certificate was revoked because it violated Apple’s policy by using it to distribute applications to users who’re not “internal” and not employees/contractors. That the app in question was also sleazy (as Facebook usually seems to be) was a coincidence in this case. The rules were written to block sleazy apps. That the rules were the instrument by which the certificates were revoked doesn’t decouple the app’s sleaziness from its removal. (Similarly, saying “he went to jail for stealing” is accurate. Despite the reason for the jailing being the statute banning stealing.)
  - saagarjha 8y ago
    > The rules were written to block sleazy apps. No, they weren't; they were written to block distribution of applications without formal App Store review to the general public.
    - kinkrtyavimoodh 8y ago
      Thank you. It's frustrating to see people completely throw facts out of the window as soon as it comes to hating on their favorite bugbears. Today Facebook and Google, tomorrow something else.
      - lloeki 8y ago
        I can see the general strategy there though: it's easier to be excessively stringent then improve and relax through iteration and emergent discovery of use cases than the other way around. E.g accessing the filesystem used to be downright impossible in the MAS, preventing apps like Coda or DaisyDisk from even existing due to stringent sandboxing, but now it's perfectly possible.
- GeekyBear 8y ago
  >Just to make it clearer, the removal of Facebook in the accounts was not about Facebook alone (though it may have been the cause for the decision). Integrations with Twitter, Vimeo, etc., were also removed together. That one has more to do with Apple releasing frameworks that allowed any of the internet services to tie into iOS themselves. For instance, share extensions: >Share extensions give users a convenient way to share content with other entities, such as social sharing websites or upload services. https://developer.apple.com/library/archive/documentation/General/Conceptual/ExtensibilityPG/Share.html https://developer.apple.com/library/archive/documentation/Ge... Apple no longer needed to pick winners and add integration for them into the OS by hand. >Facebook’s enterprise certificate was revoked because it violated Apple’s policy by using it to distribute applications to users who’re not “internal” and not employees/contractors. That the app in question was also sleazy (as Facebook usually seems to be) was a coincidence in this case. But it’s also true that that app wouldn’t have passed the App Store review process had it been submitted there. Facebook's spyware in a VPN's clothing had already been kicked off of the App Store last year. >Onavo, which Facebook bought back in 2013, does two things. As far as regular consumers are concerned, Onavo comports itself like a VPN, offering to “keep you and your data safe” and “blocking potentially harmful websites and securing your personal information.” But Onavo’s real utility is pumping a ton of app usage data to its parent company https://techcrunch.com/2018/08/22/apple-facebook-onavo/ https://techcrunch.com/2018/08/22/apple-facebook-onavo/
minikites 8y ago
>Apple is following up on their own promise to be a privacy-first company. Only after the media takes notice and it makes Apple look bad. In both this case and the "FacePalm" FaceTime spying incident, Apple knew for months. You shouldn't get brownie points for getting coerced into good behavior.
- dpcx 8y ago
  Is there a source for Apple knowing about the FaceTime incident for months?

paulryanrogers 8y ago

Actually I'd say Apple is swinging only toward user choice where it suits them. The recent change to the default media player for play-pause away from the last app and to Apple Music is one example. Dropping Do-not-track from Safari is another.

ppeetteerr 8y ago
Not sure how DNT fits into this. No advertiser respected this flag and, ironically, some used it to finger print a user's device.
- crankylinuxuser 8y ago
  Yeah, DNT was dead on arrival. I have no clue why the internet powers that be though that would be effective in any way. I guess its more of a feel good action.
  - paulryanrogers 8y ago
    It needs legislation behind it
    - exodust 8y ago
      Like "we use cookies, agree/disagree" irritating waste of space legislation that means nothing beyond the borders of wherever it was legislated?
      - Reason077 8y ago
        The EU got it wrong with the popup aspect of cookies/GDPR legislation. It's just bad UX. A DNT-style browser feature with legal weight behind it would have been miles better. Your browser could present a consistent interface for every website that requests consent, and allow you to set global defaults, etc.
        8y ago

skybrian 8y ago

Google's original business model was selling ads against search terms for users who aren't even logged in. They sell ads in a lot of other ways now, and do what they can to keep people logged in. But if they had to go back to it, they would still make lots of money, because a search query is still a really good signal of the user's intent to buy something.

willio58 8y ago
Wouldn’t duck duck go be making a lot of money by now if this was the case?
- Reason077 8y ago
  What makes you think they're not? Reportedly, duck duck go are now serving over 1 billion searches per month. If they're earning, say, $0.01 per search from ads, well... you do the math. Not bad for a small startup company with 55 employees.
  - asdfasgasdgasdg 8y ago
    That would be pretty high. Google's are in the neighborhood of $3/1000 for impressions and $0.75 per click. Recall that many SERPs don't even show ads.
- skybrian 8y ago
  If they had anywhere close to the amount of traffic Google gets, they would.
- asark 8y ago
  Look at it this way: Say tracking is perceived to add some value over content-based ad selection (doesn't matter if it actually does). Say it also provides a bunch of important looking metrics for middle managers and execs to play with, whether or not any of it means anything (that it certainly does). Say the price premium charged by Google and FaceBook and friends is under what companies value this stuff at, in dollar terms. There's a small premium to it, say 10%, some of which goes to the sites displaying the ads. Boom, practically all advertising is now of the spyware variety. That's all it takes. Competing without spying (and without a huge trove of data or a way to get it fast) is now nigh-impossible. Now outlaw all the tracking crap. "Oh no the Web is doomed no one will be able to pay for anything!" you will hear/read from a disturbingly large number of people. They are dumb. It'll be fine. That 10% premium goes away, yeah. Content advertising is back. Having a huge trove of user data is no longer a moat, or indeed much advantage at all, in the ad space, so Google'd need to scale back and/or learn how to launch a product that can stand on its own without the backing of their spyware empire. IOW yeah they'll probably actually be in serious trouble, but there's no good reason for them to be. FaceBook might die or have to pivot hard. But that does not mean the end of the web, or anything like it! It just means the ad money goes somewhere else. Probably to a bunch of much smaller (though still maybe quite large) companies. Anyway TL;DR it's difficult to succeed with non-spying ads in a spying-is-allowed world, but it's 100% for sure a viable business model that can support more or less the same junk we have now if you outlaw that sort of bad behavior. To the extent DDG's succeeding I assume it's their dark patterns and maybe (I am just guessing on this second one) they also do that extorting-companies-into-buying-ads-for-themselves thing like Google does.

kbenson 8y ago

I wonder, is there a list, possibly broken down by segment, that shows the relatively privacy friendly companies in that segment? Personally I would also like to see a check or not in a few categories for each for things like "Public statements supporting privacy", "Software/service features support privacy", "Business model supports/supported by privacy" and "has resisted/advocated against privacy encroaching laws or overly broad legal orders". That's a tall order, but it seems like the thing that could be mostly crowd-sourced to good effect (with a few moderators to ensure accuracy).

tedd4u 8y ago
Not exactly what you're looking for but EFF has some data: https://www.eff.org/who-has-your-back-2018 https://www.eff.org/who-has-your-back-2018 https://www.eff.org/who-has-your-back-2017 https://www.eff.org/who-has-your-back-2017
- kbenson 8y ago
  That's pretty nice, thanks! Although it does seem a little odd that Youtube has full marks when there's quite a lot of info about their broken take down system and appeals process...
- dzink 8y ago
  Not sure I’d trust this list. All my email addresses submitted to Adobe and previously Macromedia have come back with scammy spam of epic proportions compared to any other company I’ve submitted emails to. This list has them at 5 stars. Could be they sold or they got hacked, and maybe it no longer happens, but even new emails as of 2 years ago suffered the same fate over time.
  - kbenson 8y ago
    Not that I can vouch for the list, but it's not if Adobe got hacked, they are well known for being victims of some very large hack(s?).[1] Other than that, I hope you're not using cracked versions of any Adobe software or commercial filters, or key generators for either on systems that have any personal information... 1: https://www.theverge.com/2013/11/7/5078560/over-150-million-breached-records-from-adobe-hack-surface-online https://www.theverge.com/2013/11/7/5078560/over-150-million-...

Razengan 8y ago

As a user, I am always glad for Apple protecting me from asshole developers. There is still a lot to be done, but it would be much worse. Some bigger culprits, due to being bigger, still get away with their bullshit. For example, Google apps uses/used an embedded web view for sign-in, which also signs you into their web search in Safari. They share the sign-in in a way that even newly-installed apps can use; e.g. sign into YouTube, install Google Maps, and you will find yourself already signed into Google Maps when you open the app (in my case, for the first time on this device just now.) This may be convenient, but feels creepy and intrusive as hell. Facebook, Instagram etc. also continue to be major offenders for things like iPad UX guidelines.

deleted 8y ago
[deleted]
banachtarski 8y ago
Not a google employee but the example you cite is hardly the design of "asshole developers." Single-sign on is convenient, and I'm glad I can monitor any illicit usage/sign-on for any of the sites you mentioned in a single place. Apple protects you from asshole developers, but it also restricts you from just installing what you want in the first place and they take a 30% cut of all revenue while doing so. I hardly think they do it out of the charity of their hearts.
- pyrale 8y ago
  We track you for your own good/Apple are not an NGO anyway.
- Razengan 8y ago
  I have no need to tell YouTube my location, but if I signed into YouTube, then install Google Maps and agree to its location sharing prompt, bam, now Google can link my viewing history (and more) with my precise location, because Google Maps automatically signed into my account as soon as I launched the app. How is this not intrusive?
  - 8y ago

on_and_off 8y ago

>but as the lines become clearer users will start to shift. I wish to be wrong but e.g. facebook has demonstrated that users don't really care. Not sure that anything can change that, although I would love to see it happen.

Firadeoclus 8y ago
> I wish to be wrong but e.g. facebook has demonstrated that users don't really care. Facebook's user demographic _is_ shifting, though, and the conversation around the company and product in the media has changed significantly. That might not immediately show large effects, but network effects driving sign-up also work in reverse and could trigger an avalanche of users leaving in the future.

dalbasal 8y ago

Facebook will find it hardest of all, but at least they don't do OSS. Google ads still work (command a good price) without the creepy stuff. "in Lisbon, searching for dentists." is enough for good as targeting. Facebook ads are near worthless without the creepy targeting and such. Apple is in quite a unique position to distinguish themselves, if they choose.

have_faith 8y ago
I actually wrote something about Facebook last night: https://medium.com/@adamjaggard/facebook-will-die-of-boredom-before-any-privacy-issues-bring-it-down-14ccf358c1ce https://medium.com/@adamjaggard/facebook-will-die-of-boredom... I think Facebook will kill itself separate to everything else going on in the industry with regards to privacy. I think Facebook's value proposition is wearing thin.